10.2 Restrict access to the web administration

Information

Limit access to the web administration application to only those with a required needed.

Solution

For the administration application, edit $CATALINA_HOME/conf/server.xml and uncomment the following:
<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127\.0\.0\.1"/>
Note: The RemoteAddrValve property expects a regular expression, therefore periods and other regular expression meta-characters must be escaped.

See Also

https://workbench.cisecurity.org/files/266

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(3)

Plugin: Unix

Control ID: da2c14a5bcbea40bd3abc9ad3de4e9255e582c412a6ad514850dd05b64fe99aa